The typical computer system depends on various forms of protection software, including anti-virus and anti-spyware applications, as well as host-based firewalls. The anti-malware tools safeguard persistent state on the PC, while firewalls cleanse network input. To provide protection, these tools rely on rules and signatures developed based on knowledge of malware, attacks, and software vulnerabilities. While these techniques do not offer perfect protection, they represent the primary defense mechanism for millions of computer users.
Unfortunately, even with these protection mechanisms in place, most computers remain vulnerable to zero-day attacks based on undiscovered vulnerabilities or unknown malware. Further, it appears that zero-day attacks are likely to be a fact of life for years to come. Recent trends indicate that zero-day exploits are on the rise. As new technologies are deployed to defend against known vulnerabilities, the incentive to launch zero-day exploits will increase. As a result, future computer systems must be able to deal with, or at least recover from, zero-day attacks.
Zero-day attacks fundamentally undermine a user's confidence in the security of her machine, since they can seize control of applications and even the operating system and then use this control to disable or subvert protection software. This subversion can be subtle and thus difficult to detect. For example, it may leave the protection software running but prevent it from downloading updates needed to detect and remove the infection. By keeping a low profile, malware may remain undetected indefinitely, and throughout this time the user is unwittingly vulnerable to arbitrary malicious activity. For instance, her bank passwords may be captured, or her computer may be used to send spam or launch denial-of-service attacks.